Microsoft Changes Policy for Accessing Email — Again

Microsoft again changed its policies for accessing users’ digital accounts.

Getty Images

Microsoft is again changing its policies for accessing user information, following scrutiny over the company’s search of a customer’s email account to investigate a software leak.

In a blog post Friday, Microsoft General Counsel Brad Smith said the company will turn to law enforcement when it believes someone is “using our services to traffic in stolen intellectual or physical property from Microsoft.”

The post is Microsoft’s second response to disclosures last week that Microsoft had accessed the Hotmail account of an unnamed blogger to identify the alleged source of a leak of Microsoft software code. Hotmail is the former name for Microsoft’s Web-based email service, now called Outlook.com. Federal prosecutors charged a former Microsoft employee with leaking the code.

After news reports questioned the propriety of Microsoft searching a user’s online email account without his knowledge, the company at first promised to present evidence to an outside attorney before it looked at users’ online accounts.

The latest change, to rely on law enforcement, reflects criticism of Microsoft’s first approach and executives’ understanding that disclosures sparked by Edward Snowden changed how consumers view tech companies. “We’ve entered a ‘post-Snowden era’ in which people rightly focus on the ways others use their personal information,” Smith wrote.

Smith said the company was changing tack again “as a result of conversations we’ve had internally and with advocacy groups and other experts.” Smith said Microsoft’s terms of service at the time of the search permitted the company to legally access the blogger’s Hotmail account.

The Electronic Frontier Foundation last week said Microsoft’s initial policy shift amounted to an “internal corporate shadow court,” and it called on the company to refer potential legal infractions to law enforcement.

After Smith’s post, some digital-privacy advocates said Microsoft was making the right call.

“It was smart of Microsoft to announce this step and try to maintain user trust,” said Nicole Ozer, technology and civil liberties policy director for the ACLU of Northern California. “Companies should not be determining whether there is probable cause to search private emails. That is the job of judges.”

In his blog post, Smith said Microsoft was working to revise the terms of service for its consumer online accounts to reflect its new policy.